o
    Žõ±jY  ã                   @   s   d dl T dZdZdZdZd ZdZdZdZd	Z	d
Z
dZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZd Z d!Z!dZ"eZ#d Z$d"Z%G d#d$„ d$e&ƒZ'G d%d&„ d&e(ƒZ)d'd(„ Z*G d)d*„ d*e+ƒZ,e-e,ƒZ.d+d,„ Z/d-d.„ Z0dcd/d0„Z1d1d2„ Z2d3d4„ Z3d5d6„ Z4d7d8„ Z5d9d:„ Z6G d;d<„ d<e+ƒZ7e-e7ƒZ8e9Z:e:Z;d=Z<dZ=dZ>dZ?dZ@d ZAdZBd>ZCdZDd?ZEd@ZFdAZGdZHe@e>B ZIeAe>B e?B ZJeBe>B ZKeCe=B e>B ZLeDe>B ZMeEe=B e>B ZNeFe=B e>B ZOeGe>B ZPd ZQdZRdZSG dBdC„ dCe+ƒZTe-eTƒZUG dDdE„ dEe+ƒZVe-eVƒZWG dFdG„ dGe+ƒZXe-eXƒZYG dHdI„ dIe+ƒZZe-eZƒZ[G dJdK„ dKe+ƒZ\e-e\ƒZ]G dLdM„ dMe+ƒZ^G dNdO„ dOe_j`ƒZaeadƒZbeadPƒZceadƒZdeadQƒZeG dRdS„ dSe+ƒZfG dTdU„ dUe+ƒZgG dVdW„ dWehƒZiG dXdY„ dYe+ƒZjG dZd[„ d[e+ƒZkG d\d]„ d]ehƒZld^d_„ Zmenfd`da„ZodbS )dé   )Ú*i  i  éÿÿÿÿé    é   é   é   é   é    é@   é€   é   i   i   é   i    i @  i €  i   i   i   i   i   i    i  @ i    l        i  € i   i   i   i   i  c                   @   s^   e Zd ZdZeZdd„ Zedd„ ƒZe	dd„ ƒZ
edd	„ ƒZed
d„ ƒZdd„ Zddd„ZdS )ÚUserModeHandleab  
	Base class for non-kernel handles. Generally this means they are closed
	by special Win32 API functions instead of CloseHandle() and some standard
	operations (synchronizing, duplicating, inheritance) are not supported.
	@type _TYPE: C type
	@cvar _TYPE: C type to translate this handle to.
		Subclasses should override this.
		Defaults to L{HANDLE}.
	c                 C   ó   t ƒ ‚©N©ÚNotImplementedError©Úself© r   ú¡/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/readers/local/common/kernel32.pyÚ_closeZ   ó   zUserModeHandle._closec                 C   s   |   | j¡S r   )Ú_TYPEÚvaluer   r   r   r   Ú_as_parameter_^   ó   zUserModeHandle._as_parameter_c                 C   s   t  t j¡S r   )r   r   r   )r   r   r   r   Ú
from_paramc   r   zUserModeHandle.from_paramc                 C   ó   dS ©NFr   r   r   r   r   Úinherith   ó   zUserModeHandle.inheritc                 C   r   r   r   r   r   r   r   ÚprotectFromClosem   r!   zUserModeHandle.protectFromClosec                 C   r   r   r   r   r   r   r   Údupr   r   zUserModeHandle.dupNc                 C   r   r   r   )r   ÚdwMillisecondsr   r   r   Úwaitv   r   zUserModeHandle.waitr   )Ú__name__Ú
__module__Ú__qualname__Ú__doc__ÚHANDLEr   r   Úpropertyr   Ústaticmethodr   r    r"   r#   r%   r   r   r   r   r   K   s    



r   c                   @   sÒ   e Zd ZdZeeB eB eB eB e	B Z
eeB eB e	B Zee	B ZeeB eB eB ZeeB Zd!dd„Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd „ ZdS )"ÚMemoryBasicInformationz<
	Memory information object returned by L{VirtualQueryEx}.
	Nc                 C   sš   |du rd| _ d| _d| _d| _d| _d| _d| _dS |j | _ |j| _|j| _|j| _|j| _|j| _|j| _t|dƒr@|j| _t|dƒrK|j	| _dS dS )z¹
		@type  mbi: L{MEMORY_BASIC_INFORMATION} or L{MemoryBasicInformation}
		@param mbi: Either a L{MEMORY_BASIC_INFORMATION} structure or another
			L{MemoryBasicInformation} instance.
		NÚcontentÚfilename)
ÚBaseAddressÚAllocationBaseÚAllocationProtectÚ
RegionSizeÚStateÚProtectÚTypeÚhasattrr.   r/   )r   Úmbir   r   r   Ú__init__    s(   


ÿzMemoryBasicInformation.__init__c                 C   s"   | j |  ko| j | j k S   S )zþ
		Test if the given memory address falls within this memory region.
		@type  address: int
		@param address: Memory address to test.
		@rtype:  bool
		@return: C{True} if the given memory address falls within this memory
			region, C{False} otherwise.
		)r0   r3   )r   Úaddressr   r   r   Ú__contains__¾   s   "	z#MemoryBasicInformation.__contains__c                 C   ó
   | j tkS )zL
		@rtype:  bool
		@return: C{True} if the memory in this region is free.
		)r4   ÚMEM_FREEr   r   r   r   Úis_freeÉ   ó   
zMemoryBasicInformation.is_freec                 C   r<   )zP
		@rtype:  bool
		@return: C{True} if the memory in this region is reserved.
		)r4   ÚMEM_RESERVEr   r   r   r   Úis_reservedÐ   r?   z"MemoryBasicInformation.is_reservedc                 C   r<   )zP
		@rtype:  bool
		@return: C{True} if the memory in this region is commited.
		)r4   Ú
MEM_COMMITr   r   r   r   Úis_commited×   r?   z"MemoryBasicInformation.is_commitedc                 C   r<   )zf
		@rtype:  bool
		@return: C{True} if the memory in this region belongs to an executable
			image.
		)r6   Ú	MEM_IMAGEr   r   r   r   Úis_imageÞ   s   
zMemoryBasicInformation.is_imagec                 C   r<   )z]
		@rtype:  bool
		@return: C{True} if the memory in this region belongs to a mapped file.
		)r6   Ú
MEM_MAPPEDr   r   r   r   Ú	is_mappedæ   r?   z MemoryBasicInformation.is_mappedc                 C   r<   )zO
		@rtype:  bool
		@return: C{True} if the memory in this region is private.
		)r6   ÚMEM_PRIVATEr   r   r   r   Ú
is_privateí   r?   z!MemoryBasicInformation.is_privatec                 C   s   |   ¡ o
t| jt@ ƒS )zS
		@rtype:  bool
		@return: C{True} if all pages in this region are guard pages.
		)rC   Úboolr5   Ú
PAGE_GUARDr   r   r   r   Úis_guardô   s   zMemoryBasicInformation.is_guardc                 C   s   |   ¡ ot| jttB @ ƒ S )zW
		@rtype:  bool
		@return: C{True} if the memory in this region has any data in it.
		)rC   rJ   r5   rK   ÚPAGE_NOACCESSr   r   r   r   Úhas_contentû   s   z"MemoryBasicInformation.has_contentc                 C   ó   |   ¡ ot| j| j@ ƒS )zP
		@rtype:  bool
		@return: C{True} if all pages in this region are readable.
		)rN   rJ   r5   ÚREADABLEr   r   r   r   Úis_readable  ó   z"MemoryBasicInformation.is_readablec                 C   rO   )zQ
		@rtype:  bool
		@return: C{True} if all pages in this region are writeable.
		)rN   rJ   r5   Ú	WRITEABLEr   r   r   r   Úis_writeable	  rR   z#MemoryBasicInformation.is_writeablec                 C   rO   )a   
		@rtype:  bool
		@return: C{True} if all pages in this region are marked as
			copy-on-write. This means the pages are writeable, but changes
			are not propagated to disk.
		@note:
			Tipically data sections in executable images are marked like this.
		)rN   rJ   r5   ÚCOPY_ON_WRITEr   r   r   r   Úis_copy_on_write  s   	z'MemoryBasicInformation.is_copy_on_writec                 C   rO   )z�
		@rtype:  bool
		@return: C{True} if all pages in this region are executable.
		@note: Executable pages are always readable.
		)rN   rJ   r5   Ú
EXECUTABLEr   r   r   r   Úis_executable  s   z$MemoryBasicInformation.is_executablec                 C   rO   )zÉ
		@rtype:  bool
		@return: C{True} if all pages in this region are executable and
			writeable.
		@note: The presence of such pages make memory corruption
			vulnerabilities much easier to exploit.
		)rN   rJ   r5   ÚEXECUTABLE_AND_WRITEABLEr   r   r   r   Úis_executable_and_writeable#  s   z2MemoryBasicInformation.is_executable_and_writeabler   )r&   r'   r(   r)   ÚPAGE_EXECUTE_READÚPAGE_EXECUTE_READWRITEÚPAGE_EXECUTE_WRITECOPYÚPAGE_READONLYÚPAGE_READWRITEÚPAGE_WRITECOPYrP   rS   rU   ÚPAGE_EXECUTErW   rY   r9   r;   r>   rA   rC   rE   rG   rI   rL   rN   rQ   rT   rV   rX   rZ   r   r   r   r   r-   z   sj    ÿþýüûÿ
ÿþýÿÿÿÿþýÿÿÿ
r-   c                  C   ó   t jj} g | _t| _| ƒ S r   )ÚwindllÚkernel32ÚGetLastErrorÚargtypesÚDWORDÚrestype)Ú_GetLastErrorr   r   r   re   /  ó   re   c                   @   s:   e Zd ZdefdefdefdefdefdefdefgZdS )	ÚMEMORY_BASIC_INFORMATIONr0   r1   r2   r3   r4   r5   r6   N)r&   r'   r(   ÚSIZE_Trg   Ú_fields_r   r   r   r   rk   >  s    ùrk   c                 C   s<   t | dƒr
|  ¡  ntjj}tg|_t|_t	|_
|| ƒ d S )NÚclose)r7   rn   rc   rd   ÚCloseHandler*   rf   rJ   rh   ÚRaiseIfZeroÚerrcheck)ÚhHandleÚ_CloseHandler   r   r   ro   N  s   

ro   c                  C   rb   r   )rc   rd   ÚGetCurrentProcessIdrf   rg   rh   )Ú_GetCurrentProcessIdr   r   r   rt   [  rj   rt   c                 C   s¤   t jj}ttttg|_t|_	t
}	 t|ƒ}t d|jd ¡}|| ||t|ƒƒ}|r8d|j  k r7|k r8	 |jS  tƒ }|tkrDt |¡‚|d }|dkrQt |¡‚q)Nr   Ú r   r   r   )rc   rd   ÚQueryFullProcessImageNameWr*   rg   ÚLPWSTRÚPDWORDrf   rJ   rh   ÚMAX_PATHÚctypesÚcreate_unicode_bufferr   Úbyrefre   ÚERROR_INSUFFICIENT_BUFFERÚWinError)ÚhProcessÚdwFlagsÚ_QueryFullProcessImageNameWÚdwSizeÚlpdwSizeÚ	lpExeNameÚsuccessÚerrorr   r   r   rw   g  s&   	ö

órw   c                 C   s>   t jj}tttg|_t|_|| t|ƒ|ƒ}|t	krt
 ¡ ‚|S r   )rc   rd   ÚOpenProcessrg   ÚBOOLrf   r*   rh   rJ   ÚNULLr{   r   )ÚdwDesiredAccessÚbInheritHandleÚdwProcessIdÚ_OpenProcessr€   r   r   r   rˆ   ‚  s   rˆ   c                 C   sn   t jj}ttttttƒg|_t|_	t
 |¡}tdƒ}|| |||t|ƒƒ}|s/tƒ tkr/t
 ¡ ‚|jd |j… S ©Nr   )rc   rd   ÚReadProcessMemoryr*   ÚLPVOIDrl   ÚPOINTERrf   rJ   rh   r{   Úcreate_string_bufferr}   re   ÚERROR_PARTIAL_COPYr   Úrawr   )r€   ÚlpBaseAddressÚnSizeÚ_ReadProcessMemoryÚlpBufferÚlpNumberOfBytesReadr†   r   r   r   r�   ”  s   
r�   c                 C   sl   t jj}ttttttƒg|_t|_	t
|ƒ}t |¡}tdƒ}|| |||t|ƒƒ}|s3tƒ tkr3t ¡ ‚|jS r�   )rc   rd   ÚWriteProcessMemoryr*   r‘   rl   r’   rf   rJ   rh   Úlenr{   r“   r}   re   r”   r   r   )r€   r–   r™   Ú_WriteProcessMemoryr—   ÚlpNumberOfBytesWrittenr†   r   r   r   r›   §  s   
r›   c                 C   sT   t jj}ttttg|_t|_t	ƒ }t
t	ƒ}|| |t|ƒ|ƒ}|dkr&t ¡ ‚t|ƒS r�   )rc   rd   ÚVirtualQueryExr*   r‘   ÚPMEMORY_BASIC_INFORMATIONrl   rf   rh   rk   Úsizeofr}   r{   r   r-   )r€   Ú	lpAddressÚ_VirtualQueryExr™   ÚdwLengthr†   r   r   r   rŸ   »  s   rŸ   c                 C   s6   t jj}tg|_t|_|| ƒ}|tkrt ¡  d S d S r   )	rc   rd   Ú	LocalFreeÚHLOCALrf   rh   rŠ   r{   r   )ÚhMemÚ
_LocalFreeÚresultr   r   r   r¥   Ê  s   ÿr¥   c                   @   s"   e Zd ZdefdefdefgZdS )ÚSECURITY_ATTRIBUTESÚnLengthÚlpSecurityDescriptorrŒ   N)r&   r'   r(   rg   r‘   r‰   rm   r   r   r   r   rª   Û  s
    ýrª   iÿÿ  é   é   é   é   c                   @   s(   e Zd ZdefdefdefdefgZdS )ÚPROCESS_INFORMATIONr€   ÚhThreadr�   Ú
dwThreadIdN)r&   r'   r(   r*   rg   rm   r   r   r   r   r±     s    ür±   c                   @   ó|   e Zd Zdefdefdefdefdefdefdefdefd	efd
efdefdefdefdefdefdefdefdefgZdS )ÚSTARTUPINFOÚcbÚ
lpReservedÚ	lpDesktopÚlpTitleÚdwXÚdwYÚdwXSizeÚdwYSizeÚdwXCountCharsÚdwYCountCharsÚdwFillAttributer�   ÚwShowWindowÚcbReserved2ÚlpReserved2Ú	hStdInputÚ
hStdOutputÚ	hStdErrorN)	r&   r'   r(   rg   ÚLPSTRÚWORDr‘   r*   rm   r   r   r   r   rµ   ,  ó(    îrµ   c                   @   ó   e Zd ZdefdefgZdS )ÚSTARTUPINFOEXÚStartupInfoÚlpAttributeListN)r&   r'   r(   rµ   ÚPPROC_THREAD_ATTRIBUTE_LISTrm   r   r   r   r   rË   G  ó    þrË   c                   @   r´   )ÚSTARTUPINFOWr¶   r·   r¸   r¹   rº   r»   r¼   r½   r¾   r¿   rÀ   r�   rÁ   rÂ   rÃ   rÄ   rÅ   rÆ   N)	r&   r'   r(   rg   rx   rÈ   r‘   r*   rm   r   r   r   r   rÐ   N  rÉ   rÐ   c                   @   rÊ   )ÚSTARTUPINFOEXWrÌ   rÍ   N)r&   r'   r(   rÐ   rÎ   rm   r   r   r   r   rÑ   e  rÏ   rÑ   c                   @   s   e Zd ZdefdeffZdS )ÚSYSTEM_PROCESS_ID_INFORMATIONÚ	ProcessIdÚ	ImageNameN)r&   r'   r(   r*   ÚUNICODE_STRINGrm   r   r   r   r   rÒ   m  s    ÿrÒ   c                   @   s   e Zd Zdd„ ZdS )ÚSYSTEM_INFORMATION_CLASSc                 C   s   dt | ƒj| jf S )Nz%s(%s))Útyper&   r   r   r   r   r   Ú__repr__s  s   z!SYSTEM_INFORMATION_CLASS.__repr__N)r&   r'   r(   rØ   r   r   r   r   rÖ   r  s    rÖ   é=   éX   c                   @   s2   e Zd Zdefdefded fdefdeffZdS )ÚPROCESS_BASIC_INFORMATIONÚ	Reserved1ÚPebBaseAddressÚ	Reserved2r   ÚUniqueProcessIdÚ	Reserved3N)r&   r'   r(   ÚPVOIDÚ	ULONG_PTRrm   r   r   r   r   rÛ   |  s    
ürÛ   c                   @   s`   e Zd Zdedfdedfdedfdedfdedfdedfdedfd	edfd
edfdedff
ZdS )Ú*_PROCESS_EXTENDED_BASIC_INFORMATION_UNION1ÚIsProtectedProcessr   ÚIsWow64ProcessÚIsProcessDeletingÚIsCrossSessionCreateÚIsFrozenÚIsBackgroundÚIsStronglyNamedÚIsSecureProcessÚIsSubsystemProcessÚ	SpareBitsé   N)r&   r'   r(   ÚULONGrm   r   r   r   r   rã   ƒ  s    ÷rã   c                   @   ó    e Zd ZdZdefdeffZdS )Ú)_PROCESS_EXTENDED_BASIC_INFORMATION_UNION©ÚobjÚFlagsró   N)r&   r'   r(   Ú_anonymous_rï   rã   rm   r   r   r   r   rñ   �  ó
    ÿrñ   c                   @   s&   e Zd ZdZdefdefdeffZdS )Ú"PROCESS_EXTENDED_BASIC_INFORMATIONrò   ÚSizeÚ	BasicInforó   N)r&   r'   r(   rõ   rl   rÛ   rñ   rm   r   r   r   r   r÷   •  s    þr÷   c                   @   s(   e Zd ZdedfdedfdedffZdS )ÚUNION_PS_PROTECTIONr6   r­   ÚAuditr   ÚSignerr   N)r&   r'   r(   ÚUCHARÚBOOLEANrm   r   r   r   r   rú   œ  s
    þrú   c                   @   rð   )ÚPS_PROTECTIONrò   ÚLevelró   N)r&   r'   r(   rõ   rý   rú   rm   r   r   r   r   rÿ   ¢  rö   rÿ   c                 C   s:   t jj}ttg|_t|_t|_	t
dƒ}|| t|ƒƒ |jS r�   )rc   rd   ÚGetExitCodeThreadr*   ry   rf   rJ   rh   rp   rq   rg   r}   r   )r²   Ú_GetExitCodeThreadÚ
lpExitCoder   r   r   r  ­  s   
r  c                 C   sz   t jj}ttg|_t|_|s|dkrt}|tkr'|| |ƒ}|tkr%t	 
¡ ‚|S 	 || dƒ}|tkr5t	 
¡ ‚|tkr<	 |S q()Nr   r   éd   )rc   rd   ÚWaitForSingleObjectr*   rg   rf   rh   ÚINFINITEÚWAIT_FAILEDr{   r   ÚWAIT_TIMEOUT)rr   r$   Ú_WaitForSingleObjectÚrr   r   r   r  »  s$   

ú
úr  N)r   )pÚdefinesÚSTILL_ACTIVEr  r  ÚWAIT_OBJECT_0rM   r^   r_   r`   ra   r[   r\   r]   rK   ÚPAGE_NOCACHEÚPAGE_WRITECOMBINErB   r@   ÚMEM_DECOMMITÚMEM_RELEASEr=   rH   rF   Ú	MEM_RESETÚMEM_TOP_DOWNÚMEM_WRITE_WATCHÚMEM_PHYSICALÚMEM_LARGE_PAGESÚMEM_4MB_PAGESÚSEC_FILEÚ	SEC_IMAGEÚSEC_RESERVEÚ
SEC_COMMITÚSEC_NOCACHEÚSEC_LARGE_PAGESrD   ÚWRITE_WATCH_FLAG_RESETÚFILE_MAP_ALL_ACCESSr*   r   Úobjectr-   re   Ú	Structurerk   r’   r    ro   rt   rw   rˆ   r�   r›   rŸ   r¥   rª   ÚLPSECURITY_ATTRIBUTESr‘   rÎ   ÚLPPROC_THREAD_ATTRIBUTE_LISTÚPROC_THREAD_ATTRIBUTE_NUMBERÚPROC_THREAD_ATTRIBUTE_THREADÚPROC_THREAD_ATTRIBUTE_INPUTÚPROC_THREAD_ATTRIBUTE_ADDITIVEÚ ProcThreadAttributeParentProcessÚ ProcThreadAttributeExtendedFlagsÚProcThreadAttributeHandleListÚ ProcThreadAttributeGroupAffinityÚ ProcThreadAttributePreferredNodeÚ!ProcThreadAttributeIdealProcessorÚProcThreadAttributeUmsThreadÚ#ProcThreadAttributeMitigationPolicyÚProcThreadAttributeMaxÚ$PROC_THREAD_ATTRIBUTE_PARENT_PROCESSÚ$PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGSÚ!PROC_THREAD_ATTRIBUTE_HANDLE_LISTÚ$PROC_THREAD_ATTRIBUTE_GROUP_AFFINITYÚ$PROC_THREAD_ATTRIBUTE_PREFERRED_NODEÚ%PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSORÚ PROC_THREAD_ATTRIBUTE_UMS_THREADÚ'PROC_THREAD_ATTRIBUTE_MITIGATION_POLICYÚ-PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLEÚ7PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLEÚ/PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLEr±   ÚLPPROCESS_INFORMATIONrµ   ÚLPSTARTUPINFOrË   ÚLPSTARTUPINFOEXrÐ   ÚLPSTARTUPINFOWrÑ   ÚLPSTARTUPINFOEXWrÒ   r{   Úc_ulongrÖ   ÚProcessBasicInformationÚProcessProtectionInformationÚSystemExtendedHandleInformationÚSystemProcessIdInformationrÛ   rã   ÚUnionrñ   r÷   rú   rÿ   r  r  r  r   r   r   r   Ú<module>   sÐ   / 6


